Head of Information Security and Compliance

SINGU; Warszawa, Kraków; On-site; PLN 180,000 - 300,000; Full time

Benefits offered by this job

Private medical care

Sport card

Life insurance

Annual training budget

Team integration budget

Job summary

SINGU in Warsaw is seeking a senior information security leader to own the group’s security program across three countries. You will certify, audit, and showcase security to customers, insurers, and the board, while guiding multiple entities through one coherent program.

You’ll drive ISO 27001, GDPR, incident response, business continuity, and vendor risk with pragmatism over bureaucracy, aligning acquisitions with a strong security foundation and protecting revenue.

Qualifications

• Led information security and compliance, ideally as the most senior security person in the business.
• ISO 27001 through full audit cycle and governance experience.
• Applied GDPR in practice across multiple countries.

Responsibilities

• Own ISO 27001 and Cyber Essentials Plus across all entities; lead SOC 2 when needed.
• Manage ISMS and policies; keep them current and auditable.
• Oversee GDPR processing, DPIAs, transfers, subject requests, breach notifications.
• Support customer security assurance; respond to questionnaires and vendor contracts.
• Own incident response end-to-end; run post-mortems and drive improvements.
• Lead business continuity and disaster recovery testing annually.
• Set security baselines for endpoints and internal systems; verify compliance.
• Maintain risk register, access reviews, and control testing for executive visibility.
• Coordinate with MSPs, testers, and security vendors; manage cyber insurance relation.
• Foster security awareness across the organization.

Skills

ISO 27001

Cyber Essentials Plus

SOC 2

ISMS

GDPR

Incident response

BCP/DR

Risk management

Customer security

English proficiency

CISSP/CISM

Education

CISSP/CISM or equivalent

Job description

About SINGU

At SINGU, we’re redefining how the world’s most ambitious real estate companies run their operations. Our mission is to become Europe’s leading platform for managing warehouse, logistics, retail, and multi-site commercial real estate portfolios — empowering our Clients to protect revenue, boost efficiency, and unlock new value across every aspect of their business.

Our unified CAFM platform already powers the daily operations of over 250 million m² of real estate worldwide, supporting more than 500,000 professionals. Following our union with the UK’s Micad and Germany’s net-haus, we now help manage 100,000+ buildings across 35+ countries — and we’re just getting started.

Backed by a leading growth equity investor, we’re scaling rapidly and partnering with global leaders such as Prologis, ECE, CTP, Hillwood, Logicor, GLP, and Unibail-Rodamco-Westfield. As we continue to grow through strategic acquisitions and bold innovation, we stay true to our core values: adaptability, collaboration, and client focus.

If you’re ready to help build Europe’s leading platform for property operations — and make a tangible impact on how the real estate industry works — join SINGU and be part of this transformation.

The Role

This is the senior security role in the group, and it is yours to build. You will hold the certifications, front the audits, and be the person our customers, insurers and board ultimately rely on.

We have grown fast through acquisition. That means several entities in three countries, each at a different level of maturity, with overlapping but non-identical obligations. Your job is to bring them onto one coherent, credible programme, and keep it that way through the next acquisition. You will do it with a small team and a lot of autonomy, so pragmatism matters more here than process for its own sake.

What You'll Own

• ISO 27001 and Cyber Essentials Plus across every entity: scope, evidence, audits, recertification, and pulling newly acquired businesses in. If SOC 2 becomes commercially necessary, you will make that call and lead it.

• The ISMS and the policies behind it. Current, genuinely used, and credible to an auditor.

• GDPR across three jurisdictions: processing records, DPIAs, transfers, subject requests, breach notification.

• Customer security assurance. Questionnaires, due diligence packs, and the security terms in contracts and DPAs. You will join the calls where deals are won or stalled on security.

• Incident response, end to end. You own the plan, you run the response, and you make sure the post-mortem actually changes something.

• Business continuity and disaster recovery for group systems, tested at least annually, plus tabletop exercises with the leadership team.

• The security baselines for endpoints and internal systems such as CRM, ERP, email and collaboration. IT Operations implements them. You set them, and you verify them.

• Risk register, access reviews and control testing, reported straight to the executive team.

• External partners: MSPs, penetration testers, security vendors, and the cyber insurance relationship.

• Security awareness that people absorb rather than click through.

What This Role Is Not

Security of the SINGU product and the infrastructure hosting it belongs to Platform Engineering. Day-to-day administration of laptops and internal systems belongs to IT Operations. You set the standard and hold both to it. You are not the person reimaging a laptop.

What We're Looking For

• You have led information security and compliance, ideally as the most senior security person in the business.

• You have taken ISO 27001 through at least one full audit cycle and know where the bodies are buried.

• You have applied GDPR in practice, in more than one country.

• You have matured security across businesses at different stages, ideally in a group built by acquisition.

• You build programmes pragmatically. You can tell the difference between real risk reduction and theatre, and you protect business velocity while cutting the latter.

• You are credible in front of customers, auditors and the board, and can hold a technical line without becoming the reason a deal dies.

• CISSP, CISM or equivalent.

• Strong professional English. Polish is useful, not essential.

Why You'll Want This

• Full ownership of security for an international SaaS group, with direct access to the executive team.

• A programme you shape rather than inherit. Real problems, real budget, and the mandate to fix them properly.

• Security here enables revenue. It is a visible commercial role, not a back-office one.

• The group is still growing. What you build now becomes the standard for everything we acquire next.

• Competitive salary, aligned to seniority of the role

• Private medical care, sport card, life insurance, an annual training budget, a team integration budget, and more

Singu Group is an equal opportunity employer. We welcome applications from all backgrounds.